The Schedule

Penalties

The seven penalty items the Board may impose under s.33(1), from Rs 250 crore for security failures down to Rs 10,000 for a Data Principal’s breach of duties.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

Item 1: Breach of the obligation to take reasonable security safeguards to prevent a personal data breach, under s.8(5). Penalty may extend to Rs 250 crore.
Item 2: Breach of the obligation to give the Board or affected Data Principals notice of a personal data breach, under s.8(6). Penalty may extend to Rs 200 crore.
Item 3: Breach of the additional obligations in relation to children, under s.9. Penalty may extend to Rs 200 crore.
Item 4: Breach of the additional obligations of a Significant Data Fiduciary, under s.10. Penalty may extend to Rs 150 crore.
Item 5: Breach of the duties of a Data Principal under s.15. Penalty may extend to Rs 10,000.
Item 6: Breach of any term of a voluntary undertaking accepted by the Board under s.32. Penalty extends up to the amount applicable to the breach the proceedings concerned.
Item 7: Breach of any other provision of the Act or the rules. Penalty may extend to Rs 50 crore.

In practice

Three things about this table are routinely got wrong. Consent has no item of its own, so a consent failure falls to item 7 at Rs 50 crore, which means the Act’s largest band protects the database rather than the consent. Penalties attach per breached provision and stack, so one incident touching s.8(5) and s.8(6) exposes a fiduciary to both bands. And the band ranks the provision, not the seriousness of the particular gap: a minor failure under s.8(5) still sits in the Rs 250 crore band.

s.33PenaltiesEmpowers the Board to impose the monetary penalties in The Schedule where a breach is significant, and lists the factors that set the amount.s.8General obligations of Data FiduciaryThe operational core of the Act: accountability for processors, accuracy, security safeguards, breach intimation, erasure, published contact details and grievance redressal.s.9Processing of personal data of childrenRequires verifiable parental consent before processing a child’s data, and bans tracking, behavioural monitoring and targeted advertising directed at children.s.10Additional obligations of Significant Data FiduciaryLets the Central Government designate Significant Data Fiduciaries and imposes a DPO, an independent auditor and periodic impact assessments on them.s.42Power to amend the ScheduleLets the Central Government amend The Schedule, but caps any increase at twice the original penalty.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

The Schedule is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next